Re: [bug report] scsi: qla2xxx: Fix NULL pointer access for fcport structure

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dan,

Thanks.  Will push out a fix soon.

Regards,
Quinn Tran

-----Original Message-----
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Tuesday, January 9, 2018 at 3:06 AM
To: "Tran, Quinn" <Quinn.Tran@xxxxxxxxxx>
Cc: "linux-scsi@xxxxxxxxxxxxxxx" <linux-scsi@xxxxxxxxxxxxxxx>
Subject: [bug report] scsi: qla2xxx: Fix NULL pointer access for fcport structure

    Hello Quinn Tran,
    
    This is a semi-automatic email about new static checker warnings.
    
    The patch 5c25d451163c: "scsi: qla2xxx: Fix NULL pointer access for
    fcport structure" from Dec 28, 2017, leads to the following Smatch
    complaint:
    
        drivers/scsi/qla2xxx/qla_init.c:130 qla2x00_async_iocb_timeout()
        error: we previously assumed 'fcport' could be null (see line 107)
    
    drivers/scsi/qla2xxx/qla_init.c
       106	
       107		if (fcport) {
                        ^^^^^^^
    The patch adds a check for NULL.
    
       108			ql_dbg(ql_dbg_disc, fcport->vha, 0x2071,
       109			    "Async-%s timeout - hdl=%x portid=%06x %8phC.\n",
       110			    sp->name, sp->handle, fcport->d_id.b24, fcport->port_name);
       111	
       112			fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
       113		} else {
       114			pr_info("Async-%s timeout - hdl=%x.\n",
       115			    sp->name, sp->handle);
       116		}
       117	
       118		switch (sp->type) {
       119		case SRB_LOGIN_CMD:
       120			/* Retry as needed. */
       121			lio->u.logio.data[0] = MBS_COMMAND_ERROR;
       122			lio->u.logio.data[1] = lio->u.logio.flags & SRB_LOGIN_RETRIED ?
       123				QLA_LOGIO_LOGIN_RETRIED : 0;
       124			memset(&ea, 0, sizeof(ea));
       125			ea.event = FCME_PLOGI_DONE;
       126			ea.fcport = sp->fcport;
       127			ea.data[0] = lio->u.logio.data[0];
       128			ea.data[1] = lio->u.logio.data[1];
       129			ea.sp = sp;
       130			qla24xx_handle_plogi_done_event(fcport->vha, &ea);
                                                            ^^^^^^^^^^^
    But there is an unchecked NULL dereference here.
    
       131			break;
       132		case SRB_LOGOUT_CMD:
    
    regards,
    dan carpenter
    





[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]

  Powered by Linux